Our legal and compliance policies

This Privacy Policy explains how Yoghurt Pot Limited, trading as Motina ("Motina", "we", "us" or "our"), collects and uses personal data.

Motina is an ecommerce analytics and insights service that connects to supported ecommerce platforms, including Shopify, to analyse store data and storefront activity and identify findings, trends and opportunities.

Yoghurt Pot Limited is a company registered in England and Wales under company number 12105928, with its registered office at:

45 Tameside Stokesley TS9 5PE United Kingdom

For privacy enquiries, contact privacy@motina.co.uk.

Our Data Processing & Security Schedule provides more detailed information about the data Motina processes, retention periods, processing locations, service providers and security measures.

1. Who this policy applies to

This Privacy Policy applies to personal data relating to:

• merchants and businesses using Motina;
• people who administer or use Motina on behalf of a merchant;
• people who contact Motina for support or other enquiries;
• visitors to the Motina website;
• customers and visitors of stores using Motina, where Motina processes their data on behalf of a merchant.

The way Yoghurt Pot Limited is legally responsible for personal data depends on the context.

2. When Motina is a controller

Yoghurt Pot Limited acts as a controller where we determine why and how personal data is processed for our own purposes.

This generally includes processing relating to:

• merchant accounts and administration;
• subscriptions and billing administration;
• authentication and account security;
• merchant communications and notifications;
• customer support;
• operation and security of Motina;
• product usage analytics;
• operation of motina.co.uk;
• legal and business administration.

Where we act as controller, this Privacy Policy explains how we use that information.

3. When Motina is a processor

When Motina processes information about a merchant's customers or storefront visitors in order to provide the Service, the merchant generally determines why that information is processed.

In those circumstances:

• the merchant is generally the controller; and
• Yoghurt Pot Limited acts as the merchant's processor.

Our processing on behalf of merchants is governed by our Data Processing Addendum.

The types of Customer Personal Data processed, purposes of processing, retention periods and other operational details are set out in our Data Processing & Security Schedule.

If you are a customer or visitor of a store using Motina, the relevant merchant's privacy notice should also explain how that merchant uses your information.

4. Information we process

The information Motina processes depends on how you interact with us.

Merchants and Motina users

We may process information including:

• store and account identifiers;
• contact and notification email addresses;
• subscription and account information;
• authentication and session information;
• IP address and browser information;
• product usage information;
• support communications;
• technical, diagnostic and security information.

Merchant customers and storefront visitors

When processing information on behalf of merchants, Motina may process categories of information including:

• ecommerce order and transaction information;
• customer identifiers and email addresses where required for the Service;
• product and purchase information;
• storefront interaction and conversion events;
• browser and technical information;
• pseudonymous visitor and session identifiers;
• associations between storefront activity and resulting orders.

Motina deliberately limits the customer information it retains.

For example, although Shopify order information may contain additional customer details, Motina does not ordinarily retain customer names, postal addresses, telephone numbers, customer tags or marketing-consent information.

A detailed description of the information currently processed by Motina is available in our Data Processing & Security Schedule.

5. Information we receive from ecommerce platforms

When a merchant connects Shopify or another supported ecommerce platform, the merchant authorises Motina to access information required to provide the Service.

This may include product, inventory, order and related information.

Some ecommerce records can contain personal data about customers even where Motina does not separately request access to customer records.

Motina uses data-minimisation measures designed to avoid retaining information it does not require.

Current Shopify permissions and the categories of information retained by Motina are documented in our Data Processing & Security Schedule.

6. Storefront analytics

Motina may collect information about how visitors interact with participating merchants' storefronts.

This is used to help merchants understand activity such as:

• page and product engagement;
• add-to-cart activity;
• checkout progression;
• conversion journeys;
• product and store performance.

Where appropriate, Motina uses pseudonymous visitor and session identifiers rather than directly identifying information for storefront analytics.

Motina uses Shopify's customer privacy functionality to determine whether applicable storefront analytics may operate.

Where analytics consent is required and has not been provided, Motina does not use its normal identifiable or linkable analytics identifiers.

More information about the specific technologies used is available in our Cookie & Tracking Notice and Data Processing & Security Schedule.

7. Information collected through motina.co.uk

When you visit our website, we may process technical and analytics information relating to your visit.

We may also process information you submit through forms or other communication channels.

This may include:

• device and browser information;
• website interactions;
• analytics identifiers;
• referring information;
• name and email address where provided;
• company or store information;
• the content of enquiries or messages.

Our current website analytics, forms and related service providers are identified in our Data Processing & Security Schedule and Cookie & Tracking Notice.

8. How we use personal data as controller

Providing and administering Motina

We use merchant account and contact information to:

• provide access to Motina;
• administer accounts and subscriptions;
• provide service communications;
• maintain our relationship with merchants;
• provide support.

Our lawful basis is generally:

• performance of a contract where the individual is personally party to the contract; or
• our legitimate interests in operating our business and managing our relationship with the organisation the individual represents.

Security and operation

We may process technical, session, diagnostic and security information to:

• authenticate users;
• protect accounts and systems;
• prevent or investigate abuse;
• identify faults;
• maintain Service reliability;
• investigate security incidents.

Our lawful basis is generally our legitimate interest in operating and securing Motina.

We may also process information where necessary to comply with a legal obligation.

Improving Motina

We may analyse how merchants use Motina to understand:

• use of features;
• Service performance;
• errors and usability issues;
• potential product improvements.

Our lawful basis is generally our legitimate interest in developing and improving the Service.

Where a cookie, browser-storage technology or similar mechanism separately requires consent, we rely on consent as required.

Support and enquiries

We process contact and correspondence information to respond to requests and provide support.

Our lawful basis may be:

• performance of a contract;
• steps taken before entering a contract; or
• our legitimate interests in communicating with merchants, prospective merchants and users.

Legal purposes

We may process information where necessary to:

• comply with applicable law;
• respond to lawful requests;
• enforce our agreements;
• prevent fraud or misuse;
• establish, exercise or defend legal claims.

Our lawful basis is compliance with legal obligations or our legitimate interests, as applicable.

9. Processing on behalf of merchants

Where Motina acts as processor, we process Customer Personal Data according to the merchant's documented instructions and our agreement with that merchant.

Processing may include:

• importing ecommerce information;
• analysing store and product performance;
• analysing orders, inventory and refunds;
• measuring storefront behaviour;
• associating storefront activity with orders;
• creating aggregated metrics;
• identifying trends or anomalies;
• generating findings and opportunities;
• generating recommendations and supporting evidence;
• operating and securing the Service.

The merchant is generally responsible for determining the lawful basis for this processing.

Motina does not use a merchant's Customer Personal Data for our own independent advertising or marketing purposes.

Further details are provided in the Data Processing Addendum and Data Processing & Security Schedule.

10. Automated analysis

Motina uses automated analytical processes to examine ecommerce information and generate metrics, findings, opportunities and recommendations.

These processes may identify patterns or relationships within store and storefront information.

The purpose of this analysis is to assist merchants in making decisions about their stores.

Motina does not use this functionality to make solely automated decisions about individual shoppers that produce legal effects or similarly significant effects upon them.

11. Aggregated and anonymised information

We may generate aggregated or anonymised information from the operation of Motina.

Where information has been genuinely anonymised so that an individual is no longer identifiable, it is no longer personal data.

We may use such information to:

• understand Service performance;
• improve Motina;
• develop analytics and functionality;
• understand general ecommerce trends;
• maintain and secure the Service.

We do not attempt to re-identify genuinely anonymised information.

12. Who we share personal data with

We may disclose personal data to categories of recipients including:

• cloud hosting and infrastructure providers;
• analytics and data-processing providers;
• network and security providers;
• diagnostic and monitoring providers;
• product analytics providers;
• email and communications providers;
• customer-support providers;
• website analytics and form providers;
• ecommerce platforms;
• professional advisers;
• competent authorities where disclosure is required or permitted by law.

We do not sell merchant Customer Personal Data.

The providers currently used by Motina, their purposes and their roles are listed in our Data Processing & Security Schedule.

Corporate transactions

If Yoghurt Pot Limited or Motina is involved in a merger, acquisition, financing, reorganisation, sale of assets, insolvency, or other change of control, personal data may be disclosed to prospective or actual purchasers, investors, advisers or other parties involved in the transaction where reasonably necessary.

We will take appropriate steps to protect personal data during any such process, including using confidentiality and data-protection safeguards where appropriate. If the identity of the controller or the purposes for which personal data is used materially change following a transaction, affected individuals will be informed as required by applicable law.

13. International processing

Yoghurt Pot Limited is established in the United Kingdom.

Our principal Service infrastructure is currently located in the United Kingdom and European Economic Area, but some providers operate internationally or use service providers in other countries.

Personal data may therefore be processed outside the country in which it was originally collected.

Where applicable data-protection law restricts an international transfer, we use an appropriate transfer mechanism where required.

These may include:

• an applicable adequacy decision or regulation;
• approved Standard Contractual Clauses;
• the UK Addendum to the EU Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• another mechanism permitted by applicable law.

More detailed information about current processing locations and providers is available in our Data Processing & Security Schedule.

14. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it is processed.

The appropriate period depends on factors including:

• the type of information;
• the purpose for which it is processed;
• whether the merchant continues to use Motina;
• operational and security requirements;
• applicable legal obligations;
• whether information is required to establish, exercise or defend legal claims.

Motina maintains defined retention periods for its principal datasets.

Current retention periods, including those applying to ecommerce data, storefront analytics, visitor associations, merchant sessions, logs and backups, are published in our Data Processing & Security Schedule.

When information is no longer required, it is deleted or anonymised as appropriate.

15. Uninstalling Motina and deletion

When a Shopify merchant uninstalls Motina, our access to that store ends and Motina's applicable deletion process begins.

Motina supports Shopify's required privacy mechanisms for:

• customer data requests;
• customer deletion requests;
• store deletion requests.

Customer Personal Data can be identified and removed from applicable Motina systems in response to valid deletion instructions.

Deleted information may remain temporarily within protected backups until those backups are rotated.

Current deletion procedures and backup-retention periods are described in our Data Processing & Security Schedule.

Ending a paid subscription without uninstalling Motina does not necessarily trigger the same immediate deletion process.

16. Security

Motina maintains technical and organisational measures designed to protect personal data against accidental or unlawful:

• loss;
• destruction;
• alteration;
• disclosure;
• access.

These measures include controls relating to:

• encryption;
• access control;
• environment separation;
• data minimisation;
• service and integration security;
• logging;
• retention and deletion;
• backups and resilience;
• incident management;
• service-provider management.

A public description of these controls is provided in our Data Processing & Security Schedule.

Detailed security configuration and internal security procedures are not published.

17. Your data-protection rights

The rights available to you depend on where you live, the applicable law, our role in the processing and the circumstances involved.

Where Yoghurt Pot Limited acts as controller, you may have rights including:

• access to your personal data;
• correction of inaccurate information;
• deletion in certain circumstances;
• restriction of processing;
• objection to certain processing;
• data portability in certain circumstances;
• withdrawal of consent where processing relies on consent;
• rights relating to certain automated decision-making.

These rights are not absolute and may be subject to legal conditions or exemptions.

Where our processing is based on legitimate interests, you have the right to object to that processing in circumstances provided by applicable law.

To make a request concerning information for which Yoghurt Pot Limited acts as controller, contact:

privacy@motina.co.uk

We may need to verify your identity before responding.

18. Customers of merchants using Motina

If you are a customer or visitor of a store using Motina and your request concerns information processed by Motina on that merchant's behalf, you should normally contact the merchant directly.

The merchant is generally responsible for responding to your request as controller.

Motina assists merchants with valid data-protection requests as required by applicable law and our Data Processing Addendum.

If you contact Motina directly about Customer Personal Data processed for a merchant, we may need to refer the request to that merchant.

19. Complaints

If you have concerns about how Yoghurt Pot Limited processes personal data, contact:

privacy@motina.co.uk

If you are in the United Kingdom, you also have the right to complain to the Information Commissioner's Office (ICO).

If another data-protection authority has jurisdiction over the relevant processing, you may also have the right to complain to that authority.

20. Cookies and similar technologies

Motina and motina.co.uk may use cookies, browser local storage and similar technologies for purposes including:

• maintaining authenticated sessions;
• securing the Service;
• providing permitted storefront analytics;
• measuring use of the Motina website.

Detailed information about these technologies, their purposes and applicable choices is provided in our Cookie & Tracking Notice.

21. Children

Motina is a business service and is not directed at children.

We do not knowingly provide Motina merchant accounts to children or intentionally collect children's personal data for our own independent purposes.

A merchant's storefront may be visited by individuals of different ages. Where Motina processes storefront or order information on a merchant's behalf, the merchant remains responsible for determining whether and how that processing is lawful.

22. Changes to this Privacy Policy

We may update this Privacy Policy where necessary to reflect:

• changes to Motina;
• changes to how we process personal data;
• changes in law or regulatory guidance;
• improvements to our privacy practices.

The current version and effective date will be published on our website.

Where a change materially affects how we process personal data for our own purposes, we will take reasonable steps to bring the change to affected individuals' attention where required.

Operational details such as current providers, retention periods and infrastructure locations may be updated in the Data Processing & Security Schedule without requiring duplication in this Privacy Policy.

23. Contact us

For privacy and data-protection enquiries:

Yoghurt Pot Limited Company number: 12105928 Registered in England and Wales 45 Tameside Stokesley TS9 5PE United Kingdom

Email: privacy@motina.co.uk Website: motina.co.uk